MTU Packet counter increases during packet capture

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

MTU Packet counter increases during packet capture

L2 Linker

Hi

 

Doing some analysis and whilst doing a packet capture I notice that flow_fwd_mtu_exceeded  starts increasing rapidly.

 

Any ideas?

 

Thanks

David

show counter global filter packet-filter yes

 

flow_fwd_l3_ttl_zero                   15996        0 drop      flow      forward   Packets dropped: IP TTL reaches zero
flow_fwd_l3_noarp                     879583        0 drop      flow      forward   Packets dropped: no ARP
flow_fwd_zonechange                     3213        0 drop      flow      forward   Packets dropped: forwarded to different zone
flow_fwd_mtu_exceeded                 677903     1139 info      flow      forward   Packets lengths exceeded MTU
flow_parse_unmatched_icmperr            3882        0 info      flow      parse     Packets dropped: Unmatched ICMP error message
flow_dos_pf_ipspoof                      669        0 drop      flow      dos       Packets dropped: Zone protection option 'discard-ip-spoof'

3 REPLIES 3

Cyber Elite
Cyber Elite

the packets you're receiving are larger than the MTU on your egress interface (and likely have the DF bit set)

 

 

do both your interfaces have the same MTU set? is there a DF visible in your captures?

you may need to set TCP MSS on the egress interface to lower the mtu of your overall communication

 

 

Tom Piens
PANgurus - (co)managed services and consultancy

Thanks Reaper

 

I only notice this counter incrementing (quickly) when doing a Packet Capture on Palo. Normal operation I dont see this counter increase.

 

Thanks

David

I dug a little deeper

 

this means your packets passing through the dataplane are actually larger, but the "mtu' for packetcapture (lives on the management plane) is 1500 so you get this message

packets are not actually discarded, just processed so the pcaps can be collected

Tom Piens
PANgurus - (co)managed services and consultancy
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!